Skip to main content
Glama

Recover a rotated key

recover_api_key
Idempotent

Recover the new key of a rotation whose answer was lost, within 10 minutes, from a connection WITHOUT an API key (the previous key no longer works). rotation_id is the idempotency_key you sent to rotate_api_key; the key comes back sealed to the same X-Pluribotica-Credential-Recipient key the rotation used.

Calls v1.key_rotations.recover (POST /api/v1/key-rotations/{rotation_id}/recover); only on a connection WITHOUT an API key. Needs the header X-Pluribotica-Credential-Recipient on the connection: the key comes back only sealed to it. Retries: Repeat freely within 10 minutes with the same recipient key: it returns the same key, sealed again. Reference: https://pluribotica.com/skills/pluribotica/references/api.md#v1-key-rotations-recover

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "rotation_id": "<rotation_id>"
    },
    "name": "recover_api_key"
  }
}

Input Schema

NameRequiredDescriptionDefault
rotation_idYesThe idempotency_key (a UUID) you sent to rotate_api_key.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare idempotentHint=true and destructiveHint=false, so the description is not carrying the full burden, but it adds real value: the 10-minute validity window, the required X-Pluribotica-Credential-Recipient header, and the fact that the key returns sealed to that recipient key. The one gap is what happens once the 10 minutes elapse (error type, whether recovery is impossible), which is left to the agent to discover from the call itself.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose and the hard prerequisite, then progressively adds endpoint, header, and retry details, which suits an agent that may stop reading early. There is mild redundancy: the 'connection WITHOUT an API key' constraint is stated twice in close succession, costing a little space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter recovery tool with no output schema, the definition covers the endpoint, the required credential header, the time limit, the return form (sealed key), and the idempotent retry contract, plus a reference link. Only the post-window failure behavior and any error signal are unaddressed, a minor omission given the otherwise dense coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With a single parameter at 100% schema description coverage, the schema already defines rotation_id as the idempotency_key UUID. The description repeats that identity and adds the contextual link to rotate_api_key, but supplies no extra syntax, format, or validation nuance beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb, resource, and recovery scenario: recover the new key of a rotation whose answer was lost. It also ties itself to rotate_api_key, which is the counterpart operation the caller just performed, so an agent can place it precisely without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit conditions are given: use it when the rotation answer was lost, only on a connection WITHOUT an API key because the previous key no longer works, and only within the 10-minute window. Retry guidance is spelled out separately (repeat freely, same key returned), so when-to-use, prerequisites, and safe repetition are all covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources